[SRU] ubuntu-advantage-tools (27.5 -> 27.6) Xenial, Bionic, Focal, Impish

[Lucas Albuquerque Medeiros de Moura]

[Impact]
The main focus of this release is to allow focal cloud users to enable FIPS services on their machines. Furthermore, we are also performing some small fixes in the code:

* Fixing how apt and motd messages are updated after some ua operations
* Disable the license check job after attach/auto-attach operations.

Additionally, we are now making our logs word readable

We have spent a lot time debugging our logs to see if are leaking any credentials there, but we are now sure that we have redacted all of the private information

See the changelog entry below for a full list of changes and bugs.

[Test Case]
The following development and SRU process was followed:
https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates

The ubuntu-advantage-tools team will be in charge of attaching the artifacts and console output of the appropriate run to the bug. ubuntu-advantage-tools team members will not mark ‘verification-done’ until this has happened.

Integration test artifacts are attached to the bug.

[Regression Potential]
Most of the changes are adding new things and the integration tests make sure that the existing functionality is preserved.

However, by making the logs world readable, we could be still leaking some credentials there which would be now readable be every user on the machine.

[Discussion]
Even though the focus of this release is on allowing FIPS services on Focal machines, the major change of this release is making the logs world readable.

The reason for making the logs world readable is that we don't have any major reason keep it readable by only sudo users. Also, this will also allow for non-root users to more easily open bugs that affect the package.

We have performed several tests on different scenarios to verify that the logs are not leaking, but even though we have tested it multiple times, we could still have a blind spot on that work.

If we do have those leaks, this means that user on the machine can try to use the leaked credentials on other machines. This will not affect the machines already attached to an UA subscription.

If the team has any reservations about this work, we can better discuss a better path moving forward here.

[Changelog]

  * d/tools.postinst:
    - make log files world readable
  * New upstream release 27.6
    - cli: only go for resources on explicit help calls
    - fips:
      + allow enabling FIPS on focal clouds
      + update prompt messages
    - jobs: disable jobs after attach/auto-attach
    - message: fix how apt and motd messages are updated after ua commands

[Paride Legovini (paride)]

Dropping Hirsute from the SRU targets, as discussed.

[Robie Basak (racb)]

A couple of thoughts for consideration, but not a blocker for this upload:

1. Now that the logs are 0644, it'd be nice if the postinst didn't force override them every time, but only when upgrading from an older version. That'd allow users to be able to make local changes if they want without them getting overridden on every upgrade. And same with file ownership. However, I don't think there's any hard requirement that this be the case for log files in /var.

2. Did you have to add any additional log "redactions" recently? If so, won't old logs having their permissions changed then reveal any pre-redaction content? Or is that not the case, or is the log rotation interval long enough that this won't be a problem in practice?

[Lucas Albuquerque Medeiros de Moura (lamoura)]

Hi Robie,

I think you spotted a gap in our solution, we should be redacting older logs in the postinst function before we make then world readable. We should not rely on the logrotate functionality for this. I will remove that commit from the release and update it accordingly.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.6~22.04.1

---------------
ubuntu-advantage-tools (27.6~22.04.1) jammy; urgency=medium

  * New upstream release 27.6 (LP: #1958556)
    - cli: only request available resources from contract server when needed
    - fips:
      + allow enabling FIPS on focal clouds
      + update prompt messages
    - jobs: disable license-check job on GCP after attach
    - message: fix how apt and motd messages are updated after ua commands

 -- Lucas Moura <email address hidden> Thu, 20 Jan 2022 12:36:39 -0300

[Robie Basak (racb)]

Hello Lucas, or anyone else affected,

Accepted ubuntu-advantage-tools into impish-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.6~21.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-impish to verification-done-impish. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-impish. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Robie Basak (racb)]

Hello Lucas, or anyone else affected,

Accepted ubuntu-advantage-tools into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.6~20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Robie Basak (racb)]

Hello Lucas, or anyone else affected,

Accepted ubuntu-advantage-tools into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.6~18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Robie Basak (racb)]

Hello Lucas, or anyone else affected,

Accepted ubuntu-advantage-tools into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.6~16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Lucas Albuquerque Medeiros de Moura (lamoura)]

We have performed the test using version 27.6 found in the proposed pocket.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.6~21.10.1

---------------
ubuntu-advantage-tools (27.6~21.10.1) impish; urgency=medium

  * Backport new upstream release: (LP: #1958556) to impish

 -- Lucas Moura <email address hidden> Thu, 20 Jan 2022 18:02:36 -0300

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for ubuntu-advantage-tools has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.6~20.04.1

---------------
ubuntu-advantage-tools (27.6~20.04.1) focal; urgency=medium

  * Backport new upstream release: (LP: #1958556) to focal

 -- Lucas Moura <email address hidden> Thu, 20 Jan 2022 18:02:27 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.6~18.04.1

---------------
ubuntu-advantage-tools (27.6~18.04.1) bionic; urgency=medium

  * Backport new upstream release: (LP: #1958556) to bionic

 -- Lucas Moura <email address hidden> Thu, 20 Jan 2022 18:02:22 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.6~16.04.1

---------------
ubuntu-advantage-tools (27.6~16.04.1) xenial; urgency=medium

  * Backport new upstream release: (LP: #1958556) to xenial

 -- Lucas Moura <email address hidden> Thu, 20 Jan 2022 18:02:17 -0300